bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/face/certificate.rb

@@ -0,0 +1,165 @@
+require 'puppet/indirector/face'
+require 'puppet/ssl/host'
+
+Puppet::Indirector::Face.define(:certificate, '0.0.1') do
+  copyright "Puppet Inc.", 2011
+  license   _("Apache 2 license; see COPYING")
+
+  summary _("Provide access to the CA for certificate management.")
+  description <<-EOT
+    This subcommand interacts with a local or remote Puppet certificate
+    authority. Currently, its behavior is not a full superset of `puppet
+    cert`; specifically, it is unable to mimic puppet cert's "clean" option,
+    and its "generate" action submits a CSR rather than creating a
+    signed certificate.
+  EOT
+
+  option "--ca-location " + _("LOCATION") do
+    required
+    summary _("Which certificate authority to use (local or remote).")
+    description <<-EOT
+      Whether to act on the local certificate authority or one provided by a
+      remote puppet master. Allowed values are 'local' and 'remote.'
+
+      This option is required.
+    EOT
+
+    before_action do |action, args, options|
+      unless [:remote, :local, :only].include? options[:ca_location].to_sym
+        raise ArgumentError, _("Valid values for ca-location are 'remote', 'local', 'only'.")
+      end
+      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
+    end
+  end
+
+  action :generate do
+    summary _("Generate a new certificate signing request.")
+    arguments _("<host>")
+    returns "Nothing."
+    description <<-EOT
+      Generates and submits a certificate signing request (CSR) for the
+      specified host. This CSR will then have to be signed by a user
+      with the proper authorization on the certificate authority.
+
+      Puppet agent usually handles CSR submission automatically. This action is
+      primarily useful for requesting certificates for individual users and
+      external applications.
+    EOT
+    examples <<-EOT
+      Request a certificate for "somenode" from the site's CA:
+
+      $ puppet certificate generate somenode.puppetlabs.lan --ca-location remote
+    EOT
+
+    # Duplicate the option here explicitly to distinguish if it was passed arg
+    # us vs. set in the config file.
+    option "--dns-alt-names "+ _("NAMES") do
+      summary _("Additional DNS names to add to the certificate request")
+      description Puppet.settings.setting(:dns_alt_names).desc
+    end
+
+    when_invoked do |name, options|
+      host = Puppet::SSL::Host.new(name)
+
+      # We have a weird case where we have --dns_alt_names from Puppet, but
+      # this option is --dns-alt-names. Until we can get rid of --dns-alt-names
+      # or do a global tr('-', '_'), we have to support both.
+      # In supporting both, we'll use Puppet[:dns_alt_names] if specified on
+      # command line. We'll use options[:dns_alt_names] if specified on
+      # command line. If both specified, we'll fail.
+      # jeffweiss 17 april 2012
+
+      global_setting_from_cli = Puppet.settings.set_by_cli?(:dns_alt_names) == true
+      raise ArgumentError, _("Can't specify both --dns_alt_names and --dns-alt-names") if options[:dns_alt_names] and global_setting_from_cli
+      options[:dns_alt_names] = Puppet[:dns_alt_names] if global_setting_from_cli
+
+      # If dns_alt_names are specified via the command line, we will always add
+      # them. Otherwise, they will default to the config file setting iff this
+      # cert is for the host we're running on.
+
+      unless Puppet::FileSystem.exist?(Puppet[:hostcert])
+        Puppet.push_context({:ssl_host => host})
+      end
+
+      host.generate_certificate_request(:dns_alt_names => options[:dns_alt_names])
+    end
+  end
+
+  action :list do
+    summary _("List all certificate signing requests.")
+    returns <<-EOT
+      An array of #inspect output from CSR objects. This output is
+      currently messy, but does contain the names of nodes requesting
+      certificates. This action returns #inspect strings even when used
+      from the Ruby API.
+    EOT
+
+    when_invoked do |options|
+      Puppet::SSL::Host.indirection.search("*", {
+        :for => :certificate_request,
+      }).map { |h| h.inspect }
+    end
+  end
+
+  action :sign do
+    summary _("Sign a certificate signing request for HOST.")
+    arguments _("<host>")
+    returns <<-EOT
+      A string that appears to be (but isn't) an x509 certificate.
+    EOT
+    examples <<-EOT
+      Sign somenode.puppetlabs.lan's certificate:
+
+      $ puppet certificate sign somenode.puppetlabs.lan --ca-location remote
+    EOT
+
+    option("--[no-]allow-dns-alt-names") do
+      summary _("Whether or not to accept DNS alt names in the certificate request")
+    end
+
+    when_invoked do |name, options|
+      host = Puppet::SSL::Host.new(name)
+      if Puppet::SSL::Host.ca_location == :remote
+        if options[:allow_dns_alt_names]
+          raise ArgumentError, _("--allow-dns-alt-names may not be specified with a remote CA")
+        end
+
+        host.desired_state = 'signed'
+        Puppet::SSL::Host.indirection.save(host)
+      else
+        # We have to do this case manually because we need to specify
+        # allow_dns_alt_names.
+        unless ca = Puppet::SSL::CertificateAuthority.instance
+          raise ArgumentError, _("This process is not configured as a certificate authority")
+        end
+
+        signing_options = {allow_dns_alt_names: options[:allow_dns_alt_names]}
+
+        ca.sign(name, signing_options)
+      end
+    end
+  end
+
+  # Indirector action doc overrides
+  find = get_action(:find)
+  find.summary _("Retrieve a certificate.")
+  find.arguments _("<host>")
+  find.render_as = :s
+  find.returns <<-EOT
+    An x509 SSL certificate.
+
+    Note that this action has a side effect of caching a copy of the
+    certificate in Puppet's `ssldir`.
+  EOT
+
+  destroy = get_action(:destroy)
+  destroy.summary _("Delete a certificate.")
+  destroy.arguments _("<host>")
+  destroy.returns "Nothing."
+  destroy.description <<-EOT
+    Deletes a certificate. This action currently only works on the local CA.
+  EOT
+
+  deactivate_action(:search)
+  deactivate_action(:save)
+end

data/vendored/puppet/lib/puppet/face/certificate_request.rb

@@ -0,0 +1,56 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:certificate_request, '0.0.1') do
+  copyright "Puppet Inc.", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary _("Manage certificate requests.")
+  description <<-EOT
+    This subcommand retrieves and submits certificate signing requests (CSRs).
+  EOT
+
+  deactivate_action(:destroy)
+
+  find = get_action(:find)
+  find.summary "Retrieve a single CSR."
+  find.arguments "[<host>]"
+  find.render_as = :s
+  find.returns <<-EOT
+    A single certificate request. When used from the Ruby API, returns a
+    Puppet::SSL::CertificateRequest object.
+
+    Defaults to the current nodes certname.
+  EOT
+  find.examples <<-EOT
+    Retrieve a single CSR from the puppet master's CA:
+
+    $ puppet certificate_request find somenode.puppetlabs.lan --terminus rest
+  EOT
+
+  search = get_action(:search)
+  search.summary "Retrieve all outstanding CSRs."
+  search.arguments "<dummy_text>"
+  search.render_as = :s
+  search.returns <<-EOT
+    A list of certificate requests. When used from the Ruby API, returns an
+    array of Puppet::SSL::CertificateRequest objects.
+  EOT
+  search.short_description <<-EOT
+    Retrieves all outstanding certificate signing requests. Due to a known bug,
+    this action requires a dummy search key, the content of which is irrelevant.
+  EOT
+  search.notes <<-EOT
+    Although this action always returns all CSRs, it requires a dummy search
+    key; this is a known bug.
+  EOT
+  search.examples <<-EOT
+    Retrieve all CSRs from the local CA (similar to 'puppet cert list'):
+
+    $ puppet certificate_request search x --terminus ca
+  EOT
+
+  get_action(:save).summary "API only: submit a certificate signing request."
+  get_action(:save).arguments "<x509_CSR>"
+
+  deprecate
+end

data/vendored/puppet/lib/puppet/face/certificate_revocation_list.rb

@@ -0,0 +1,56 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:certificate_revocation_list, '0.0.1') do
+  copyright "Puppet Inc.", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary _("Manage the list of revoked certificates.")
+  description <<-EOT
+    This subcommand is primarily for retrieving the certificate revocation
+    list from the CA.
+  EOT
+
+  find = get_action(:find)
+  find.summary "Retrieve the certificate revocation list."
+  find.render_as = :s
+  find.returns <<-EOT
+    The certificate revocation list. When used from the Ruby API: returns an
+    OpenSSL::X509::CRL object.
+  EOT
+  find.short_description <<-EOT
+    Retrieves the certificate revocation list.
+  EOT
+  find.notes <<-EOT
+    Although this action always returns the CRL from the specified terminus.
+  EOT
+  find.examples <<-EXAMPLES
+    Retrieve a copy of the puppet master's CRL:
+
+    $ puppet certificate_revocation_list find --terminus rest
+  EXAMPLES
+
+  destroy = get_action(:destroy)
+  destroy.summary "Delete the certificate revocation list."
+  destroy.arguments "<dummy_text>"
+  destroy.returns "Nothing."
+  destroy.description <<-EOT
+    Deletes the certificate revocation list. This cannot be done over REST, but
+    it is possible to delete the locally cached copy or the local CA's copy of
+    the CRL.
+  EOT
+  destroy.short_description <<-EOT
+    Deletes the certificate revocation list. This cannot be done over REST, but
+    it is possible to delete the locally cached copy or the local CA's copy of
+    the CRL. Due to a known bug, this action requires a dummy argument, the
+    content of which is irrelevant.
+  EOT
+  destroy.notes <<-EOT
+    Although this action always deletes the CRL from the specified terminus, it
+    requires a dummy argument; this is a known bug.
+  EOT
+
+  deactivate_action(:search)
+  deactivate_action(:save)
+
+  deprecate
+end

data/vendored/puppet/lib/puppet/face/config.rb

@@ -0,0 +1,210 @@
+require 'puppet/face'
+require 'puppet/settings/ini_file'
+
+Puppet::Face.define(:config, '0.0.1') do
+  copyright "Puppet Inc.", 2011
+  license   _("Apache 2 license; see COPYING")
+
+  summary _("Interact with Puppet's settings.")
+
+  description "This subcommand can inspect and modify settings from Puppet's
+    'puppet.conf' configuration file. For documentation about individual settings,
+    see https://docs.puppetlabs.com/puppet/latest/reference/configuration.html."
+
+  option "--section " + _("SECTION_NAME") do
+    default_to { "main" }
+    summary _("The section of the configuration file to interact with.")
+    description <<-EOT
+      The section of the puppet.conf configuration file to interact with.
+
+      The three most commonly used sections are 'main', 'master', and 'agent'.
+      'Main' is the default, and is used by all Puppet applications. Other
+      sections can override 'main' values for specific applications --- the
+      'master' section affects puppet master and puppet cert, and the 'agent'
+      section affects puppet agent.
+
+      Less commonly used is the 'user' section, which affects puppet apply. Any
+      other section will be treated as the name of a legacy environment
+      (a deprecated feature), and can only include the 'manifest' and
+      'modulepath' settings.
+    EOT
+  end
+
+  action(:print) do
+    summary _("Examine Puppet's current settings.")
+    arguments _("(all | <setting> [<setting> ...]")
+    description <<-'EOT'
+      Prints the value of a single setting or a list of settings.
+
+      This action is an alternate interface to the information available with
+      `puppet <subcommand> --configprint`.
+    EOT
+    notes <<-'EOT'
+      By default, this action reads the general configuration in the 'main'
+      section. Use the '--section' and '--environment' flags to examine other
+      configuration domains.
+    EOT
+    examples <<-'EOT'
+      Get puppet's runfile directory:
+
+      $ puppet config print rundir
+
+      Get a list of important directories from the master's config:
+
+      $ puppet config print all --section master | grep -E "(path|dir)"
+    EOT
+
+    when_invoked do |*args|
+      options = args.pop
+      render_all_settings = args.empty? || args == ['all']
+
+      args = Puppet.settings.to_a.collect(&:first) if render_all_settings
+
+      values_from_the_selected_section =
+        Puppet.settings.values(nil, options[:section].to_sym)
+
+      loader_settings = {
+        :environmentpath => values_from_the_selected_section.interpolate(:environmentpath),
+        :basemodulepath => values_from_the_selected_section.interpolate(:basemodulepath),
+      }
+
+      to_be_rendered = nil
+      Puppet.override(Puppet.base_context(loader_settings),
+                     _("New environment loaders generated from the requested section.")) do
+        # And now we can lookup values that include those from environments configured from
+        # the requested section
+        values = Puppet.settings.values(Puppet[:environment].to_sym, options[:section].to_sym)
+
+        to_be_rendered = {}
+        args.sort.each do |setting_name|
+          to_be_rendered[setting_name] = values.print(setting_name.to_sym)
+        end
+      end
+
+      # convert symbols to strings before formatting output
+      if render_all_settings
+        to_be_rendered = stringifyhash(to_be_rendered)
+      end
+      to_be_rendered
+    end
+
+    when_rendering :console do |to_be_rendered|
+      output = ''
+      if to_be_rendered.keys.length > 1
+        to_be_rendered.keys.sort.each do |setting|
+          output << "#{setting} = #{to_be_rendered[setting]}\n"
+        end
+      else
+        output << "#{to_be_rendered.to_a[0].last}\n"
+      end
+
+      output
+    end
+  end
+
+  def stringifyhash(hash)
+    newhash = {}
+    hash.each do |key, val|
+      key = key.to_s
+      if val.is_a? Hash
+        newhash[key] = stringifyhash(val)
+      elsif val.is_a? Symbol
+        newhash[key] = val.to_s
+      else
+        newhash[key] = val
+      end
+    end
+    newhash
+  end
+
+  action(:set) do
+    summary _("Set Puppet's settings.")
+    arguments _("[setting_name] [setting_value]")
+    description <<-'EOT'
+      Updates values in the `puppet.conf` configuration file.
+    EOT
+    notes <<-'EOT'
+      By default, this action manipulates the configuration in the
+      'main' section. Use the '--section' flag to manipulate other
+      configuration domains.
+    EOT
+    examples <<-'EOT'
+      Set puppet's runfile directory:
+
+      $ puppet config set rundir /var/run/puppetlabs
+
+      Set the vardir for only the agent:
+
+      $ puppet config set vardir /opt/puppetlabs/puppet/cache --section agent
+    EOT
+
+    when_invoked do |name, value, options|
+      if name == 'environment' && options[:section] == 'main'
+        Puppet.warning _(<<-EOM).chomp
+The environment should be set in either the `[user]`, `[agent]`, or `[master]`
+section. Variables set in the `[agent]` section are used when running
+`puppet agent`. Variables set in the `[user]` section are used when running
+various other puppet subcommands, like `puppet apply` and `puppet module`; these
+require the defined environment directory to exist locally. Set the config
+section by using the `--section` flag. For example,
+`puppet config --section user set environment foo`. For more information, see
+https://puppet.com/docs/puppet/latest/configuration.html#environment
+        EOM
+      end
+
+      path = Puppet::FileSystem.pathname(Puppet.settings.which_configuration_file)
+      Puppet::FileSystem.touch(path)
+      Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|
+        Puppet::Settings::IniFile.update(file) do |config|
+          config.set(options[:section], name, value)
+        end
+      end
+      nil
+    end
+  end
+
+  action(:delete) do
+    summary _("Delete a Puppet setting.")
+    arguments _("(<setting>")
+    #TRANSLATORS 'main' is a specific section name and should not be translated
+    description "Deletes a setting from the specified section. (The default is the section 'main')."
+    notes <<-'EOT'
+      By default, this action deletes the configuration setting from the 'main'
+      configuration domain. Use the '--section' flags to delete settings from other
+      configuration domains.
+    EOT
+    examples <<-'EOT'
+      Delete the setting 'setting_name' from the 'main' configuration domain:
+
+      $ puppet config delete setting_name
+
+      Delete the setting 'setting_name' from the 'master' configuration domain:
+
+      $ puppet config delete setting_name --section master
+    EOT
+
+    when_invoked do |name, options|
+      options[:section] = options[:section].to_s # If value was left as default - set to default string
+
+      path = Puppet::FileSystem.pathname(Puppet.settings.which_configuration_file)
+      if Puppet::FileSystem.exist?(path)
+        Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|
+          Puppet::Settings::IniFile.update(file) do |config|
+            setting_string = config.delete(options[:section], name)
+            if setting_string
+              puts(_("Deleted setting from '%{section_name}': '%{setting_string}'") %
+                       { section_name: options[:section], name: name, setting_string: setting_string.strip })
+            else
+              Puppet.warning(_("No setting found in configuration file for section '%{section_name}' setting name '%{name}'") %
+                                 { section_name: options[:section], name: name })
+            end
+          end
+        end
+      else
+        #TRANSLATORS the 'puppet.conf' is a specific file and should not be translated
+        Puppet.warning(_("The puppet.conf file does not exist %{puppet_conf}") % { puppet_conf: path })
+      end
+      nil
+    end
+  end
+end